Problems Hinder EMV Use in US

Despite the stupidity they regularlyencourage, Americans' credit cards are on the verge of becoming a whole lot smarter.

EMV cards -- also known as "smartchip" and "chip and PIN" cards -- are credit cards that use smartcard technology instead of the "swipe-the-stripe" standard invented in the 1960s.

Americans are almost exclusively familiar with magnetic stripe credit cards. Meanwhile, people in Europe, Asia, and, well, pretty much the rest of the world use credit cards with EMV ("Europay, Mastercard, Visa") technology.

Unlike magnetic stripe cards, EMV-enabled cards uniquely encrypt transaction data for each use. This makes them substantially more secure, because it is much harder for skimmers to steal the card data.

What's more, most EMV-enabled cards are dually enabled with magnetic stripes, accommodating people from other countries traveling in the US. Meanwhile, US travelers often have difficulties using their credit cards abroad.

These compatibility issues may soon be a thing of the past if major financial service multinationals have their way.

Since this past summer, credit card companies have been making a huge push to encourage US retailers and ATMs to accept EMV cards over the next few years. Visa is being particularly aggressive, offering to waive fees for US retailers that accept EMV-enabled cards -- while refusing to offer fraud protection to those that do not switch over by 2013. By 2015, all US retailers accepting Visa will have to accept EMV cards. (At least, that's Visa's goal.)

Banks, too, are going along with the EMV push in the US. Wells Fargo, JPMorgan Chase, and US Bank already offer EMV-enabled cards to qualifying American customers who travel abroad. A month ago, Bank of America Merrill Lynch announced that it will begin offering EMV-enabled credit cards early next year to US customers who travel abroad.

Historically, however, Americans have been reluctant to do things the way the rest of the world does them (for example, the metricsystem). And here, too, there is some resistance.

Part of the reason is security. It may have advantages over magnetic stripe cards, but EMV is far from a perfect technology. It has several security weaknesses of its own. In 2010, a group of researchers at the University of Cambridge released devastating findings in a paper called "Chip and PIN is Broken." In the paper, the Cambridge researchers reported multiple EMV security vulnerabilities. Perhaps most appallingly, they found that "the proceedings of the PIN verification step are never explicitly authenticated."

The researchers went on to discuss myriad attacks on the UK's chip and PIN system that succeeded by way of a man-in-the-middle device that intercepts communications signals and tricks the terminal into acting as if the customer's PIN were verified. Little evidence of these attacks is typically available by the time a cardholder reports the fraud. These security issues are compounded by problematically bureaucratic dispute resolution processes. Many defrauded UK cardholders have their refund requests denied by card issuers, whose records show -- quite incorrectly -- that the cardholder's PIN was used and verified. These findings are hardly encouraging.

According to the researchers, the US Federal Reserve should resist pressure from banks to move to EMV until a satisfactory solution to EMV's security woes is published. "It’s not reasonable for the smart card industry to foist a broken framework on the US banking industry and then leave it to individual issuer banks to come up with patches."

Infrastructure is another obstacle to widespread US adoption. NFC technology is still fairly nascent for US retailers, and it could take a lot of time for loyalty programs to convince US consumers to accept a new EMV standard. Julie Conroy McNelley, a senior analyst at Aite Group's retail banking practice, says "there's no way" Visa can reach its 2015 EMV goal.

It remains to be seen precisely how EMV adoption will go and, given the weaknesses, whether a different technology could come along in the US or elsewhere to fix the EMV problems. But as Conroy McNelley concedes, "EMV is a heck of a lot better than what we have right now."

Good article, Joe. I do agree with McNelley's assertion that there's no way the 2015 goal is possible, certainly.

EMV is better than what we have now, but is it good enough? I'm not certain. I just have a feeling that this is going to be skipped over in the US in favor of some other, superior, more US-centric tech. As you mention, Americans tend to like to do things their own way and tend not to be too enthusiastic about adapting to worldwide (especially European) standards.

So I'm not really sure how successful adoption would be. I would tend to be pessimistic. But I suppose we'll see!

I can understand why we shouldn't have EMV "foisted upon" retailers and customers, if there are legitimate security concerns. However, it isn't as though magnetic stripe cards are 100% secure either. Regardless of what Visa demands of retailers however, I don't see why banks wouldn't start issuing dual-purpose cards as a matter of course, instead of some special service for international travelers.

Rather than revamping the entire system and replacing the magnetic technology with EMV, I think they should go about using hybrid cards which cater to both technologies. As far as the security issues are concerned, I read about special pouches for credit cards which would block the access to cards and prevent them from being read without user's consent.

@ Sara a few years back retaliers were "encouraged" to add technology that allowed people to waive their credit card in front of a scanner. Needless to say we spent a lot of money and the whole thing did not catch on. However EVM sounds like something that has a much greater benefit.

EMV Resources

Increasing counterfeit card fraud led the financial industry to move to smart chip technology for bank cards and to develop the global EMV standard for bank cards based on chip card technology. The EMV specification, first available in 1996 and managed by EMVCo, defines the global interoperable standard for smart bank cards.

Financial institutions in the United States, Europe, Latin America, Asia/Pacific and Canada are issuing contact or dual-interface EMV smart cards for credit and debit payment or migrating to EMV issuance. According to EMVCo, approximately 1.2 billion EMV cards have been issued globally and 18.7 million POS terminals accept EMV cards as of Q1 2011. This represents 40.1% of the total payment cards in circulation and 71% of the POS terminals installed globally.

EMVCo developed its specifications to ensure global interoperability–so that any EMV-compliant card can be accepted at any EMV-compliant point-of-sale anywhere in the world. The EMV specifications not only define how chip cards can be used for fraud prevention but how they can be used by issuers to offer additional features to cardholders such as multiple payment applications on the same card. Chip cards can carry security credentials that are encoded by the card issuer at personalization. These credentials, or keys, are encrypted and impervious to access by unauthorized parties. These credentials therefore prevent card cloning, one of the common ways magnetic stripe cards are compromised and used for fraudulent activity. In practical terms, this means that chip card-based payment account information cannot be skimmed, which increases the level of security to prevent fraud.

Fraud prevention technology in chip-based EMV payment cards (which can be contact, contactless or dual-interface cards) complements post-fraud detection mechanisms by providing an additional layer of intelligence to protect consumers. Issuers, acquirers and merchants in a large number of markets around the world have decided to implement full EMV technology. Some programs are signature-based and others use a PIN, commonly known as "chip and PIN," to combat fraud.

About EMV

The EMV Integrated Circuit Card Specifications are managed by EMVCo, which is currently operated by American Express, JCB International, MasterCard International, and Visa International. EMV specifications were first issued in 1996 and active working groups have provided updates and revisions. In December of 2000, EMV 4.0 was released which is also known as EMV 2000. The current version of EMV is release 4.2.

At the heart of EMV is the underlying security framework that provides fraud protection for both offline and online transactions. The security is a combination of symmetric and asymmetric key technology. First, EMV leverages the security found in chip cards and requires symmetric authentication keys to be submitted to gain access to the chip card's memory. In addition, asymmetric keys and certificates, also known as public key infrastructure (PKI), are incorporated to facilitate card authentication in offline transaction environments.

The blogs and comments posted on EnterpriseEfficiency.com do not reflect the views of TechWeb, EnterpriseEfficiency.com, or its sponsors. EnterpriseEfficiency.com, TechWeb, and its sponsors do not assume responsibility for any comments, claims, or opinions made by authors and bloggers. They are no substitute for your own research and should not be relied upon for trading or any other purpose.

Enterprise Efficiency is looking for engaged readers to moderate the message boards on this site. Engage in high-IQ conversations with IT industry leaders; earn kudos and perks. Interested? E-mail: [email protected]

Now that TGen has broken new ground in genomic research by using Dell's storage, cloud, and high-performance computing solutions, the company discusses what will come next for it and for personalized medicine.

The Translational Genomics Research Institute wanted to save lives, but its efforts were hobbled by immense computing challenges related to collecting, processing, sharing, and storing enormous amounts of data.

Nasdaq OMX is being investigated by Swedish competition authorities as to whether it pressured Verizon to keep a competing exchange called Burgundy from collocating in the same datacenter as its biggest customers.